Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24261 - Before 1 Plugin
The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
PLUGIN
Before 1
CVE-2021-24261
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24260 - Before 6 Plugin
The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
PLUGIN
Before 6
CVE-2021-24260
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24259 - Before 1 Plugin
The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
PLUGIN
Before 1
CVE-2021-24259
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24272 - Fitness Calculators Plugin
The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue
PLUGIN
Fitness Calculators
CVE-2021-24272
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24258 - Elements Kit Elementor Addons Plugin
The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
PLUGIN
Elements Kit Elementor Addons
CVE-2021-24258
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24257 - Before 4 Plugin
The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
PLUGIN
Before 4
CVE-2021-24257
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24256 - Before 1 Plugin
The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
PLUGIN
Before 1
CVE-2021-24256
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24255 - Essential Addons For Elementor Lite Plugin
The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.
PLUGIN
Essential Addons For Elementor Lite
CVE-2021-24255
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24240 - Business Hours Pro Plugin
The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.
PLUGIN
Business Hours Pro
CVE-2021-24240
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24238 - Before 1 Plugin
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter.
PLUGIN
Before 1
CVE-2021-24238
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24241 - Advanced Custom Fields Pro Plugin
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.
PLUGIN
Advanced Custom Fields Pro
CVE-2021-24241
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24239 - Payments Plugin
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
PLUGIN
Payments
CVE-2021-24239
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24237 - Before 1 Plugin
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.
PLUGIN
Before 1
CVE-2021-24237
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24235 - Goto Plugin
The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.
PLUGIN
Goto
CVE-2021-24235
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24234 - Ivory Search Plugin
The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.
PLUGIN
Ivory Search
CVE-2021-24234
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24233 - Cooked Pro Plugin
The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.
PLUGIN
Cooked Pro
CVE-2021-24233
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24232 - Advanced Booking Calendar Plugin
The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue
PLUGIN
Advanced Booking Calendar
CVE-2021-24232
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24242 - Elearning And Online Course Solution Plugin
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
PLUGIN
Elearning And Online Course Solution
CVE-2021-24242
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24229 - Level Ajax Action Of The Patreon Plugin
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.
PLUGIN
Level Ajax Action Of The Patreon
CVE-2021-24229
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24228 - Team Identified A Reflected Cross Site Scripting In The Login Form Of The Patreon Plugin
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized.
PLUGIN
Team Identified A Reflected Cross Site Scripting In The Login Form Of The Patreon
CVE-2021-24228
Risk Score